We can still rely on TLS for data integrity & authentication of the server.
Ultimately, this is about retaining the atproto’s data model which roots authority in the DID, not the server. Falling back to TLS changes the security, trust & authority of the protocol.
A (non-exhaustive) example of this in action: consider a self-hoster who loses access to their domain name (maybe they forgot to renew & it expired). With location-based authority (TLS), whoever has their domain now can post as them. In atproto, this should not be possible unless that person has control of their DID or the key material referenced by the DID.
This is a good point & we should probably bind in some extra information into the signature. Something like sig(sha256("atproto-space-commit-v1" +space_ref + rev + ikm)
This would prevent ikm-reuse